IPsec tunnel - Large BDP Link, Congestion Algo. & Window Sizes?

[eroper]

I have an IPsec tunnel set up with a reasonably high rtt (~200ms). I'm experiencing terrible throughput whenever the link isn't (for practical purposes) 100% loss free. This clearly isn't unique to pfSense or IPsec as any high latency, high bandwidth link is subject to the same pain points.

It did get me thinking about the following question however:

Given: [Host-A] <-> [pfSense-A(ipSec)] <–--> [pfSense-B(ipSec)] <-> [Host-B]

In the absence of the ipSec tunnel I would tune the TCP window size (receive buffers) and possibly the TCP congestion algorithm used on Host-A, Host-B.

With an ipSec tunnel, do the tunnel endpoints need the tuning? The hosts on either side? Or Both?

If the IPsec gateways would be tuned, which TCP Congestion Algorithm is pfSense using by default and does it support any alternatives?

Thanks,
Ed

[eri--]

Yeah the hosts need the tunning since they generate the traffic IPsec cannot do much here.